f1bbcc5c678d174d858ae089f4494e3ea8bcfc418098d61804a15e437f08aff7

Target

[email protected]
Size

1.9MB
MD5

cb02c0438f3f4ddabce36f8a26b0b961
SHA1

48c4fcb17e93b74030415996c0ec5c57b830ea53
SHA256

64677f7767d6e791341b2eac7b43df90d39d9bdf26d21358578d2d38037e2c32
SHA512

373f91981832cd9a1ff0b8744b43c7574b72971b5b6b19ea1f4665b6c878f7a1c7834ac08b92e0eca299eb4b590bf10f48a0485350a77a5f85fc3d2dd6913db3

Score

1^/10

Malware Config

Kills process with taskkill 7 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeAUDIODG.EXE

description	pid	Process
Token: SeDebugPrivilege	3268	taskkill.exe
Token: SeDebugPrivilege	1404	taskkill.exe
Token: SeDebugPrivilege	1936	taskkill.exe
Token: SeDebugPrivilege	3936	taskkill.exe
Token: SeDebugPrivilege	1304	taskkill.exe
Token: SeDebugPrivilege	3644	taskkill.exe
Token: SeDebugPrivilege	2180	taskkill.exe
Token: 33	200	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	200	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

pid	Process
540	[email protected]

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

pid	Process
540	[email protected]

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

description	pid	Process	procid_target
PID 540 wrote to memory of 1936	540	[email protected]	78
PID 540 wrote to memory of 1936	540	[email protected]	78
PID 540 wrote to memory of 1936	540	[email protected]	78
PID 540 wrote to memory of 1404	540	[email protected]	79
PID 540 wrote to memory of 1404	540	[email protected]	79
PID 540 wrote to memory of 1404	540	[email protected]	79
PID 540 wrote to memory of 3268	540	[email protected]	80
PID 540 wrote to memory of 3268	540	[email protected]	80
PID 540 wrote to memory of 3268	540	[email protected]	80
PID 540 wrote to memory of 3644	540	[email protected]	83
PID 540 wrote to memory of 3644	540	[email protected]	83
PID 540 wrote to memory of 3644	540	[email protected]	83
PID 540 wrote to memory of 3936	540	[email protected]	85
PID 540 wrote to memory of 3936	540	[email protected]	85
PID 540 wrote to memory of 3936	540	[email protected]	85
PID 540 wrote to memory of 1304	540	[email protected]	87
PID 540 wrote to memory of 1304	540	[email protected]	87
PID 540 wrote to memory of 1304	540	[email protected]	87
PID 540 wrote to memory of 2180	540	[email protected]	89
PID 540 wrote to memory of 2180	540	[email protected]	89
PID 540 wrote to memory of 2180	540	[email protected]	89

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3dc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:200

memory/540-7-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/540-0-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/540-3-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/540-4-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/540-5-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/540-6-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/540-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/1304-13-0x0000000000000000-mapping.dmp

Download
memory/1404-9-0x0000000000000000-mapping.dmp

Download
memory/1936-8-0x0000000000000000-mapping.dmp

Download
memory/2180-14-0x0000000000000000-mapping.dmp

Download
memory/3268-10-0x0000000000000000-mapping.dmp

Download
memory/3644-11-0x0000000000000000-mapping.dmp

Download
memory/3936-12-0x0000000000000000-mapping.dmp

Download